Splunk Search

Aliasing and Graphing events at search

craigwilkinson
Path Finder

Hi All,

Apologies if this is too simple question and has been asked 100 times, But i can't seem to find the answer I'm looking for..

For the time being, I simply want to graph the number transaction status over time from a sourcetype which shows the following: "SUCCESS" "FAILED", "BLOCKED"...

However, for failed transactions, the data is coming in with failed status= "FAIL" or "FAILURE".

How can I make "FAILED = FAIL + FAILURE", and plot the status = SUCCESS & status = BLOCKED along side it?

I'm currently using the search:
sourcetype= mydata | stats count by status

As per below:

Cheers,

Craigalt text

0 Karma
1 Solution

HiroshiSatoh
Champion

Try this!

sourcetype= mydata|eval status=if(status="FAIL" OR status="FAILER","FAILED",status) | stats count by status

View solution in original post

jplumsdaine22
Influencer

Since Hiroshi beat me to it with eval, for completeness here is how you can do it with foreach

sourcetype= mydata 
| stats count by status 
| foreach status [eval <<FIELD>> = if((<<FIELD>>=="FAIL" OR <<FIELD>>=="FAILURE"),"FAILED",<<FIELD>>) ] 
| stats sum(count) as count by status

See: http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Foreach

craigwilkinson
Path Finder

Thanks for the reply mate.

Interested to investigate this method a little further,

When I run your command, it doesn't seem to return any results :s

0 Karma

jplumsdaine22
Influencer

interesting - it definately should!

Here's a run anywhere example:

|gentimes start=-1
| eval status="FAIL"
| stats count by status
 | foreach status [eval <<FIELD>> = if((<<FIELD>>=="FAIL" OR <<FIELD>>=="FAILURE"),"FAILED",<<FIELD>>) ] 
 | stats sum(count) as count by status
0 Karma

HiroshiSatoh
Champion

Try this!

sourcetype= mydata|eval status=if(status="FAIL" OR status="FAILER","FAILED",status) | stats count by status

jplumsdaine22
Influencer

Beat me to it!

0 Karma

craigwilkinson
Path Finder

Awesome, thanks guys 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...